1. Statement of the Technical Field
The present invention relates to the field of file security and digital rights management, and more particularly to methods and systems for transparently protecting, controlling and managing files in a collaborative environment.
2. Description of the Related Art
Prior to the advent of the information age, protecting sensitive files seemed simple—limit the number of hard copies and secure existing hard copies under lock and key. The digital revolution, however, has eased the manner in which files can be shared amongst a vast audience resulting in the inability of authors to limit the number of copies made of an electronic file and the associated distribution of those electronic files. In consequence, financial losses attributable to the misappropriation of sensitive electronic files are increasing each day.
Virtually every business supporting electronic data interchange and e-business faces the threat of cybercrime. A breach in security of an Internet credit card transaction, or the distribution of confidential files by dishonest employees may result in devastating losses to the company. United States legislation has addressed cybercrime in the Computer Fraud and Abuse Act of 1986, in which it is a felony to obtain information to which a person is not entitled through the unauthorized access or exceeded authorization. Still, nationwide United States Attorneys have been slow to prosecute those corporate insiders who violate the Computer Fraud and Abuse Act of 1986.
Whether facilitated by dishonest or merely careless employees, the misappropriation and compromise of sensitive files has caused significant disruptions among businesses in the global business community. Notwithstanding, corporate insiders operating as professional thieves can be even more elusive than and destructive than merely dishonest or careless employees. Many studies have concluded that competitors, disgruntled employees and independent hackers alike are intent upon stealing sensitive corporate information at any opportunity.
Government agencies, law firms, investment banks, accounting and auditing firms and engineering organizations are particularly sensitive to the unauthorized appropriation of sensitive data. In particular, it is of paramount concern to protect the contents of electronic versions of legal agreements, proposals, functional and technical specifications and technical drawings. Yet, many have a tendency to ignore threats to sensitive data until after the sensitive data has been misappropriated.
Tampering or theft of sensitive files is not the only concern for those who manage files in the enterprise. Business electronic mail (e-mail) usage continues to grow at an astounding rate. It is clear that e-mail has become a critical mode of inter and intra-business communications. Nevertheless, every transmitted e-mail and corresponding e-mail attachment can result in an unintentional breach of security. In particular, when a party other than the intended recipient of the e-mail accesses the e-mail, the intent of a secure transaction has been lost.
Several products have been developed in recent times to address the problem of securing files from unintentional or malicious misappropriation. For example, Authentica, Inc. of Waltham, Mass. (Authentica) has developed a system for securing sensitive electronic files, even after those sensitive files have been distributed to selected recipients. More particularly, in the Authentica system sensitive files can be encrypted and access policies including digital rights applied thereto prior to transmitting the file to a recipient.
Once an encrypted file has been received, the recipient can access a central server to assist the recipient in decrypting the encrypted file. Of course, the server also can ensure that the recipient has access privileges which satisfy the access policies of the sensitive file. Finally, the digital rights included with the encrypted file can ensure that the recipient does not exceed the recipient's authority to modify or further distribute the sensitive file.
Still, inasmuch as the Authentica solution is a client/server solution, the Authentica system requires that the recipient maintain a network connection to the central server when the recipient attempts to access an encrypted file. Thus, the Authentica system lacks flexibility. Furthermore, the Authentica solution is not transparent in that accessing a file protected using the Authentica system requires substantial user interaction and the deployment of a separate application. Specifically, to enforce the digital rights associated with a protected file, for example whether a user can modify, copy, or print the file, the Authentica system utilizes a separate file viewer. The use of a separate file viewer, however, can inhibit the transparency necessary to conduct effective file collaboration.
Infraworks Corporation of Austin, Tex., by comparison, has developed a server-independent solution in which file security can be managed by a client-side plug-in containing all necessary logic to control access to an attached file. Developed to specifically address the security of e-mail distributed files, the Infraworks solution, however, lacks the ability to secure collaborative files which are not necessarily distributed via e-mail. For instance, the Infraworks solution cannot secure a collaborative file accessed over a network through the conventional file-open dialog box of a word-processor. Moreover, the Infraworks solution, like the Authentica solution, lacks the transparency required to effectively promote file collaboration.
Importantly, file collaboration has become an important element of inter and intra-business activities. Specifically, it has become a common occurrence for corporate competitors to intentionally collaborate with one another using commonly accessible files, despite the sensitivity of the contents of those files. In fact, in many cases competitors and corporate partners alike exchange sensitive files via e-mail and e-mail attachments. File collaboration also can result in the unintentional modification or destruction of a commonly shared file. In particular, in the collaborative environment, it is not uncommon for collaborators to accidentally lose or destroy electronic files.
In many cases, those who would engage in file collaboration may do so in the presence or absence of network facilities. Specifically, often it can be desirable to access a secure file while disengaged from a network, such as while traveling or while at home. In consequence, in a collaborative environment, those who intentionally disseminate sensitive data also must track and enforce limitations on the use and further dissemination of the sensitive data, regardless of the availability of a centralized server configured to control such limitations on the use and further dissemination of the sensitive data. Furthermore, the enforcement of such limitations must occur transparently so as to promote effective, yet seamless file collaboration.